What is the Law 25 DSAR deadline?

Under Act respecting the protection of personal information in the private sector (as amended by Bill 64 / Law 25) (Law 25), the standard response deadline is 30 days. The counting method is calendar days, starting from the day of receipt.

Can I extend a Law 25 deadline?

Yes. An extension of 10 days is available when: Processing the request within the original deadline is not possible. You must notify the data subject within: Within the original 30-day deadline with reasons for extension.

Law 25 is enforced by Commission d'accès à l'information du Québec (CAI). Maximum penalties: CAD $25M or 4% of worldwide turnover (whichever is greater).

🇨🇦Law 25

Quebec — Law 25 DSAR Deadline Calculator

Calculate your exact response deadline under Act respecting the protection of personal information in the private sector (as amended by Bill 64 / Law 25) (Law 25).

Configure your DSAR

Select jurisdiction, request type, and date — results update instantly.

Jurisdiction

Your deadline will appear here

Select a jurisdiction and request type to get started

Law 25 Overview

Full Name

Act respecting the protection of personal information in the private sector (as amended by Bill 64 / Law 25)

Effective Since

2023-09-22

Regulatory Authority

Commission d'accès à l'information du Québec (CAI)

Official Text

View law

Maximum Penalties

CAD $25M or 4% of worldwide turnover (whichever is greater)

Request Types & Deadlines

Request Type	Deadline	Extension
Right of Access Right to access personal information held by an enterprise	30 days	+10 days
Right to Rectification Right to have inaccurate, incomplete, or equivocal information corrected	30 days	+10 days
Right to Deletion Right to request deletion of personal information (de-indexing)	30 days	+10 days
Right to Portability Right to receive personal information in a structured, commonly used format	30 days	+10 days

Extension Rules

Extension period: 10 days

Conditions: Processing the request within the original deadline is not possible

Notification required: Within the original 30-day deadline with reasons for extension

Special Rules & Common Mistakes

•Must respond within 30 calendar days of receiving the request
•Extension of up to 10 additional calendar days with written notice and reasons
•Quebec Law 25 replaces PIPEDA for private-sector data processing within Quebec
•Right to data portability became effective January 2024
•Privacy Impact Assessments (PIAs) required for certain projects
•Mandatory breach notification to the CAI and affected individuals
•Penalties significantly increased under Law 25 amendments

Compare with Other Jurisdictions

Law	Deadline	Method	Extension
🇨🇦 Quebec Law 25	30 days	calendar days	+10 days
🇪🇺 EU GDPR	1 months	calendar months	+2 months
🇬🇧 UK GDPR	1 months	calendar months	+2 months
🇺🇸 CCPA	45 days	calendar days	+45 days